mir/openvswitch
2
0
Fork 0
mirror of https://github.com/openvswitch/ovs synced 2025-10-21 14:49:41 +00:00
Code Issues Releases Wiki Activity
Files
edc2055a2bf73258d5731a8f8853397190348b04
openvswitch/lib/daemon.man

85 lines
3.7 KiB
Groff
Raw Normal View History

docs: Improve formatting for daemon options in a few manpages. daemon.man is meant to have a heading above it, but in a few manpages its text was running directly into the previous documentation because this had been overlooked. By adding .PP to daemon.man, we make this problem less severe if the heading is similarly omitted in future manpages, since at least it will then have its own paragraph instead of running into the previous one. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Andy Zhou <azhou@ovn.org>
2017-05-08 10:43:17 -04:00
.PP
daemon-windows: Ability to handle windows service calls. The following code does not add any users yet. The visioned workflow that this piece of code should work with is: * Create a windows service through a startup script with a tool like 'sc' ex: sc create ovsdb-server binpath= "C:\openvswitch\usr\sbin\ovsdb-server.exe -vconsole:off -vsyslog:off -vfile:info --remote=ptcp:6632:127.0.0.1 --log-file --service-monitor --service" * Start the service from the startup script. ex: sc start ovsdb-server * Terminate the service during shutdown process. ex: sc stop ovsdb-server * Abrupt termination will restart the service. Signed-off-by: Gurucharan Shetty <gshetty@nicira.com> Acked-by: Ben Pfaff <blp@nicira.com>
2014-01-16 16:16:24 -08:00
The following options are valid on POSIX based platforms.
Import from old repository commit 61ef2b42a9c4ba8e1600f15bb0236765edc2ad45.
2009-07-08 13:19:16 -07:00
.TP
daemon: Clarify documentation. CC: Yu Zhiguo <yuzg@cn.fujitsu.com>
2010-06-29 12:32:16 -07:00
\fB\-\-pidfile\fR[\fB=\fIpidfile\fR]
Import from old repository commit 61ef2b42a9c4ba8e1600f15bb0236765edc2ad45.
2009-07-08 13:19:16 -07:00
Causes a file (by default, \fB\*(PN.pid\fR) to be created indicating
daemon: Clarify documentation. CC: Yu Zhiguo <yuzg@cn.fujitsu.com>
2010-06-29 12:32:16 -07:00
the PID of the running process. If the \fIpidfile\fR argument is not
specified, or
Import from old repository commit 61ef2b42a9c4ba8e1600f15bb0236765edc2ad45.
2009-07-08 13:19:16 -07:00
if it does not begin with \fB/\fR, then it is created in
\fB@RUNDIR@\fR.
daemon: Clarify documentation. CC: Yu Zhiguo <yuzg@cn.fujitsu.com>
2010-06-29 12:32:16 -07:00
.IP
doc: Change "-" to "\-" in appropriate places. The newer manpages tend to get this right more often than the old ones, but there were lots of places that needed to be corrected.
2010-06-29 14:29:40 -07:00
If \fB\-\-pidfile\fR is not specified, no pidfile is created.
Fix excessive white space in manpages. In nroff manpages, a blank line adds vertical white space. When this is followed by another command that also starts a new paragraph, the result is a vertical skip twice as big as the normal inter-paragraph gap. The solution is to use a line that contains just "." for white space within the manpage, instead of a blank line. The resulting manpages look better.
2010-02-24 13:42:43 -08:00
.
Import from old repository commit 61ef2b42a9c4ba8e1600f15bb0236765edc2ad45.
2009-07-08 13:19:16 -07:00
.TP
doc: Change "-" to "\-" in appropriate places. The newer manpages tend to get this right more often than the old ones, but there were lots of places that needed to be corrected.
2010-06-29 14:29:40 -07:00
\fB\-\-overwrite\-pidfile\fR
By default, when \fB\-\-pidfile\fR is specified and the specified pidfile
daemon: Remove short options from daemon library The daemon library provides a few short options, but these then take away their availability from programs that wish to use the library. Since the daemon options are generally going to be called from a script (which doesn't care how much typing is involved), we'll only provide long options.
2009-08-05 14:20:24 -07:00
already exists and is locked by a running process, \fB\*(PN\fR refuses
doc: Change "-" to "\-" in appropriate places. The newer manpages tend to get this right more often than the old ones, but there were lots of places that needed to be corrected.
2010-06-29 14:29:40 -07:00
to start. Specify \fB\-\-overwrite\-pidfile\fR to cause it to instead
daemon: Remove short options from daemon library The daemon library provides a few short options, but these then take away their availability from programs that wish to use the library. Since the daemon options are generally going to be called from a script (which doesn't care how much typing is involved), we'll only provide long options.
2009-08-05 14:20:24 -07:00
overwrite the pidfile.
Fix excessive white space in manpages. In nroff manpages, a blank line adds vertical white space. When this is followed by another command that also starts a new paragraph, the result is a vertical skip twice as big as the normal inter-paragraph gap. The solution is to use a line that contains just "." for white space within the manpage, instead of a blank line. The resulting manpages look better.
2010-02-24 13:42:43 -08:00
.IP
doc: Change "-" to "\-" in appropriate places. The newer manpages tend to get this right more often than the old ones, but there were lots of places that needed to be corrected.
2010-06-29 14:29:40 -07:00
When \fB\-\-pidfile\fR is not specified, this option has no effect.
Fix excessive white space in manpages. In nroff manpages, a blank line adds vertical white space. When this is followed by another command that also starts a new paragraph, the result is a vertical skip twice as big as the normal inter-paragraph gap. The solution is to use a line that contains just "." for white space within the manpage, instead of a blank line. The resulting manpages look better.
2010-02-24 13:42:43 -08:00
.
docs: Document that --detach disables logging to the console. Reported-by: "P.R.Dinesh" <pr.dinesh@gmail.com> Reported-at: http://openvswitch.org/pipermail/discuss/2015-December/019567.html Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Gurucharan Shetty <guru@ovn.org>
2015-12-01 09:55:17 -08:00
.IP \fB\-\-detach\fR
Runs \fB\*(PN\fR as a background process. The process forks, and in
the child it starts a new session, closes the standard file
descriptors (which has the side effect of disabling logging to the
console), and changes its current directory to the root (unless
\fB\-\-no\-chdir\fR is specified). After the child completes its
initialization, the parent exits. \*(DD
Fix excessive white space in manpages. In nroff manpages, a blank line adds vertical white space. When this is followed by another command that also starts a new paragraph, the result is a vertical skip twice as big as the normal inter-paragraph gap. The solution is to use a line that contains just "." for white space within the manpage, instead of a blank line. The resulting manpages look better.
2010-02-24 13:42:43 -08:00
.
daemon: Add support for process monitoring and restart.
2010-01-15 12:13:46 -08:00
.TP
doc: Change "-" to "\-" in appropriate places. The newer manpages tend to get this right more often than the old ones, but there were lots of places that needed to be corrected.
2010-06-29 14:29:40 -07:00
\fB\-\-monitor\fR
daemon: Add support for process monitoring and restart.
2010-01-15 12:13:46 -08:00
Creates an additional process to monitor the \fB\*(PN\fR daemon. If
the daemon dies due to a signal that indicates a programming error
daemon: Precisely document signals that cause the monitor to restart. Signed-off-by: Ben Pfaff <blp@nicira.com> Acked-by: Joe Stringer <joestringer@nicira.com>
2013-10-11 16:52:50 -07:00
(\fBSIGABRT\fR, \fBSIGALRM\fR, \fBSIGBUS\fR, \fBSIGFPE\fR,
\fBSIGILL\fR, \fBSIGPIPE\fR, \fBSIGSEGV\fR, \fBSIGXCPU\fR, or
\fBSIGXFSZ\fR) then the monitor process starts a new copy of it. If
the daemon dies or exits for another reason, the monitor process exits.
daemon: Add support for process monitoring and restart.
2010-01-15 12:13:46 -08:00
.IP
doc: Change "-" to "\-" in appropriate places. The newer manpages tend to get this right more often than the old ones, but there were lots of places that needed to be corrected.
2010-06-29 14:29:40 -07:00
This option is normally used with \fB\-\-detach\fR, but it also
daemon: Add support for process monitoring and restart.
2010-01-15 12:13:46 -08:00
functions without it.
Fix excessive white space in manpages. In nroff manpages, a blank line adds vertical white space. When this is followed by another command that also starts a new paragraph, the result is a vertical skip twice as big as the normal inter-paragraph gap. The solution is to use a line that contains just "." for white space within the manpage, instead of a blank line. The resulting manpages look better.
2010-02-24 13:42:43 -08:00
.
daemon: Provide option to not chdir to root By default, Open vSwitch daemons change their working directories to the root directory. This commit provides a --no-chdir option to prevent this behavior.
2009-08-04 22:41:46 -07:00
.TP
doc: Change "-" to "\-" in appropriate places. The newer manpages tend to get this right more often than the old ones, but there were lots of places that needed to be corrected.
2010-06-29 14:29:40 -07:00
\fB\-\-no\-chdir\fR
By default, when \fB\-\-detach\fR is specified, \fB\*(PN\fR
daemon: Provide option to not chdir to root By default, Open vSwitch daemons change their working directories to the root directory. This commit provides a --no-chdir option to prevent this behavior.
2009-08-04 22:41:46 -07:00
changes its current working directory to the root directory after it
detaches. Otherwise, invoking \fB\*(PN\fR from a carelessly chosen
directory would prevent the administrator from unmounting the file
system that holds that directory.
.IP
doc: Change "-" to "\-" in appropriate places. The newer manpages tend to get this right more often than the old ones, but there were lots of places that needed to be corrected.
2010-06-29 14:29:40 -07:00
Specifying \fB\-\-no\-chdir\fR suppresses this behavior, preventing
daemon: Provide option to not chdir to root By default, Open vSwitch daemons change their working directories to the root directory. This commit provides a --no-chdir option to prevent this behavior.
2009-08-04 22:41:46 -07:00
\fB\*(PN\fR from changing its current working directory. This may be
useful for collecting core files, since it is common behavior to write
core dumps into the current working directory and the root directory
is not a good directory to use.
.IP
doc: Change "-" to "\-" in appropriate places. The newer manpages tend to get this right more often than the old ones, but there were lots of places that needed to be corrected.
2010-06-29 14:29:40 -07:00
This option has no effect when \fB\-\-detach\fR is not specified.
lib/daemon: support --user option for all OVS daemon OVS daemons can now support --user option to run as a non-root user with less privileges. See the manpage patch for more descriptions. Signed-off-by: Andy Zhou <azhou@nicira.com> Acked-by: Ben Pfaff <blp@nicira.com>
2015-09-11 11:26:39 -07:00
.
.TP
bridge: allow OVS to interact with controller through sockets outside run dir Currently Open vSwitch is unable to create or connect to Unix Domain Sockets outside designated 'run' directory, because of fear of potential remote exploits where a hacked remote OVSDB manager would tell Open vSwitch to connect to a unix domain socket owned by other daemon on the same hypervisor. This patch allows to disable this behavior by changing /etc/default/openvswitch (Ubuntu) or /etc/sysconfig/openvswitch (RHEL) file to: ... OVS_CTL_OPTS=--no-self-confinement ... Note, that it is better to stick with default behavior, unless: 1. You have Open vSwitch running under SELinux or AppArmor that would prevent OVS from messing with sockets owned by other daemons; OR 2. You are sure that relying on OpenFlow handshake is enough to prevent OVS to adversely interact with those other daemons running on the same hypervisor; OR 3. You don't have much worries of remote exploits in the first place, because perhaps OVSDB manager is running on the same host as OVS. The initial use-case for this patch is to allow to connect to OpenFlow controller that has its socket outside OVS run directory. However, in the future it could be generalized to allow to disable self-confinement for other things like DPDK vhost-user sockets or anything else that is specifiable in OVSDB with full path. Signed-off-by: Ansis Atteka <aatteka@ovn.org> Acked-by: Jesse Gross <jesse@kernel.org> VMware-BZ: #1525857
2016-06-20 14:19:40 -07:00
\fB\-\-no\-self\-confinement\fR
By default daemon will try to self-confine itself to work with
files under well-know, at build-time whitelisted directories. It
is better to stick with this default behavior and not to use this
flag unless some other Access Control is used to confine daemon.
Note that in contrast to other access control implementations that
are typically enforced from kernel-space (e.g. DAC or MAC),
self-confinement is imposed from the user-space daemon itself and
hence should not be considered as a full confinement strategy, but
instead should be viewed as an additional layer of security.
.
.TP
lib/daemon: support --user option for all OVS daemon OVS daemons can now support --user option to run as a non-root user with less privileges. See the manpage patch for more descriptions. Signed-off-by: Andy Zhou <azhou@nicira.com> Acked-by: Ben Pfaff <blp@nicira.com>
2015-09-11 11:26:39 -07:00
\fB\-\-user\fR
lib: simplify daemon_become_new_user__() A global variable 'switch_user' was used to make sure we switch process's current user only once. This logic is now simplified by testing for uid directly; if switch process has taken place, the current uid will be not be zero. Signed-off-by: Andy Zhou <azhou@nicira.com> Acked-by: Ansis Atteka <aatteka@nicira.com>
2015-10-09 18:48:59 -07:00
Causes \fB\*(PN\fR to run as a different user specified in "user:group", thus
dropping most of the root privileges. Short forms "user" and ":group" are also
lib/daemon: support --user option for all OVS daemon OVS daemons can now support --user option to run as a non-root user with less privileges. See the manpage patch for more descriptions. Signed-off-by: Andy Zhou <azhou@nicira.com> Acked-by: Ben Pfaff <blp@nicira.com>
2015-09-11 11:26:39 -07:00
allowed, with current user or group are assumed respectively. Only daemons
started by the root user accepts this argument.
.IP
On Linux, daemons will be granted CAP_IPC_LOCK and CAP_NET_BIND_SERVICES
daemon: Minor tweaking of man page fragment. Signed-off-by: Justin Pettit <jpettit@ovn.org> Acked-by: Ben Pfaff <blp@ovn.org> Acked-by: Ryan Moats <rmoats@us.ibm.com>
2016-08-10 16:05:14 -07:00
before dropping root privileges. Daemons that interact with a datapath,
netlink linux: enable listening to all nsids Internal ports may be moved to another network namespace and when that happens, the vswitch stops receiving netlink notifications. This patch enables the vswitch to listen to all network namespaces that have a nsid assigned into the network namespace where the socket has been opened. It requires kernel 4.2 or newer. Signed-off-by: Flavio Leitner <fbl@redhat.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
2018-03-29 23:05:29 -03:00
such as \fBovs\-vswitchd\fR, will be granted three additional capabilities,
namely CAP_NET_ADMIN, CAP_NET_BROADCAST and CAP_NET_RAW. The capability
change will apply even if the new user is root.
lib/daemon: support --user option for all OVS daemon OVS daemons can now support --user option to run as a non-root user with less privileges. See the manpage patch for more descriptions. Signed-off-by: Andy Zhou <azhou@nicira.com> Acked-by: Ben Pfaff <blp@nicira.com>
2015-09-11 11:26:39 -07:00
.IP
On Windows, this option is not currently supported. For security reasons,
specifying this option will cause the daemon process not to start.
Reference in New Issue Copy Permalink